What problem does it solve? Manual security code review often misses deep vulnerabilities like IDOR, race conditions, and auth bypasses because they require tracing user input across many layers of code. This Skill provides a systematic methodology for finding exploitable, high-severity vulnerabilities with clear proof-of-concept evidence. ## Core Features & Use Cases - Deep Data-Flow Tracking: Trace user-controlled input from entry points through transformations to dangerous sinks like SQL queries, shell commands, and file operations. - Auth Bypass Pattern Detection: Identify incomplete authorization checks, JWT validation flaws, OAuth misconfigurations, IDOR, and TOCTOU race conditions. - Severity Calibration: Assign Critical/High/Medium/Low severity only when a reproducible exploit path exists, reducing false positives. - Use Case: Reviewing a Django REST API before launch, trace request parameters into ORM queries, find an endpoint missing an ownership check, and document a working IDOR exploit with a step-by-step PoC. ## Quick Start Review this codebase for security vulnerabilities, tracing user input to dangerous sinks and reporting only findings with reproducible exploit paths.
